Second, if you are using anything below 1024 other than 80 for HTTP then
you are violating the basic principle of those being reserved ports and
you should ask yourself "why" you are using those ports? Do you
know why they exist?
The basic idea is if you trust the host then you can trust all ports under
1024 to be what they say they are and not users running trojan horses
on them.
HTTP in general has nothing to loose by being spoofed so it doesn't have to
run on a secure port unless you are sending authentication or sensitive
information, and in those cases you should *ONLY* talk to port 80 on
trusted hosts (this is why you should never send anything you want kept
private via email, because it passes through untrusted hosts).
So please don't use ports other than 80 unless they are over 1024.
And browsers should warn users before sending sensitive information
(like userid/passwd in the clear) to ports other than 80.
--sanders